DevSecOps Adoption Practitioner
About the Position
We are looking for a Secure Engineering / DevSecOps Adoption Practitioner to join a long term capital markets program. You are the security SME embedded within engineering squads, educating through hands on involvement rather than auditing from the outside. You configure tools, triage findings with developers, and own the security evidence pipeline for program governance. The role requires working from the office three days per week. The candidate should be based in either Cluj Napoca or Bucharest.
About the Project
DataArt squads are embedded within client product delivery teams on a multi year modernization program. The Secure Engineering Practitioner works hands on within squads, configures security tooling, conducts code reviews with a security focus, and creates the compliance evidence artifacts required by the client's InfoSec framework. Teams are distributed across the EU and work fully remotely.
Responsibilities
- Review code at the pull request stage, flag vulnerabilities, and educate developers in context.
- Configure and maintain SAST tools (SonarQube, Checkmarx, Semgrep) within CI/CD pipelines, and define and enforce gate thresholds.
- Implement DAST scanning for APIs and services, and triage results with developers.
- Generate and maintain SBOMs for all program components, and automate updates for each release.
- Manage dependency scanning and the vulnerability remediation backlog.
- Implement secrets management practices, including eliminating hard coded credentials, automating credential rotation, and enforcing least privilege IAM.
- Produce security evidence artifacts for program governance and InfoSec reviews.
- Conduct practical enablement sessions on the OWASP Top 10 and secure coding practices.
Requirements
- 5+ years of experience in security engineering or DevSecOps, with mandatory hands on tooling experience.
- Experience with SAST and DAST tools, including SonarQube, Checkmarx, Semgrep, OWASP ZAP, and Burp Suite.
- Experience with SBOM tools and standards, including CycloneDX, SPDX, Syft, and Grype.
- Experience with dependency scanning tools such as OWASP Dependency Check, Snyk, or equivalent solutions, including CVE triage.
- Experience with secrets management tools such as AWS Secrets Manager, HashiCorp Vault, GitLeaks, or TruffleHog.
- Experience with IAM and least privilege practices in AWS, including security group and network policy reviews.
- Experience implementing CI/CD security gates using GitHub Actions or Jenkins.
- Ability to explain vulnerabilities to developers in actionable terms.
- Proficient English for technical communication (B2+).
Nice to Have
- CSSLP, CEH, or AWS Security Specialty certification.
- Experience with financial services regulatory compliance, including FCA or ISO 27001.
- Background in web application or API penetration testing.
